DO NOT MERGE: Check number of attributes before writing to a buffer

[android-x86/system-bt.git] / btif / src / btif_rc.c

diff --git a/btif/src/btif_rc.c b/btif/src/btif_rc.c
index 8805f4f..28a2499 100644 (file)
--- a/btif/src/btif_rc.c
+++ b/btif/src/btif_rc.c
@@ -47,6 +47,7 @@
 #include "osi/include/list.h"
 #include "osi/include/properties.h"
 #include "btu.h"
+#include "log/log.h"
 #define RC_INVALID_TRACK_ID (0xFFFFFFFFFFFFFFFFULL)
 
 /*****************************************************************************
@@ -279,6 +280,7 @@ static void btif_rc_upstreams_rsp_evt(UINT16 event, tAVRC_RESPONSE *pavrc_resp,
 #endif
 static void rc_start_play_status_timer(void);
 static bool absolute_volume_disabled(void);
+static char const* key_id_to_str(uint16_t id);
 
 /*****************************************************************************
 **  Static variables
@@ -331,7 +333,7 @@ void send_key (int fd, uint16_t key, int pressed)
         return;
     }
 
-    BTIF_TRACE_DEBUG("AVRCP: Send key %d (%d) fd=%d", key, pressed, fd);
+    LOG_INFO(LOG_TAG, "AVRCP: Send key %s (%d) fd=%d", key_id_to_str(key), pressed, fd);
     send_event(fd, EV_KEY, key, pressed);
     send_event(fd, EV_SYN, SYN_REPORT, 0);
 }
@@ -2763,6 +2765,12 @@ static void handle_app_cur_val_response (tBTA_AV_META_MSG *pmeta_msg, tAVRC_GET_
     bdcpy(rc_addr.address, btif_rc_cb.rc_addr);
 
     app_settings.num_attr = p_rsp->num_val;
+
+    if (app_settings.num_attr > BTRC_MAX_APP_SETTINGS) {
+        android_errorWriteLog(0x534e4554, "73824150");
+        app_settings.num_attr = BTRC_MAX_APP_SETTINGS;
+    }
+
     for (xx = 0; xx < app_settings.num_attr; xx++)
     {
         app_settings.attr_ids[xx] = p_rsp->p_vals[xx].attr_id;
@@ -4250,3 +4258,11 @@ static bool absolute_volume_disabled() {
     }
     return false;
 }
+
+static char const* key_id_to_str(uint16_t id) {
+    for (int i = 0; key_map[i].name != NULL; i++) {
+        if (id == key_map[i].mapped_id)
+            return key_map[i].name;
+    }
+    return "UNKNOWN KEY";
+}